CVE-2026-6741

🗓️ 27 Apr 2026 19:36:46Reported by WordfenceType

cve🔗 web.nvd.nist.gov👁 21 Views🌐 WEB

LatePoint privilege escalation up to 5.4.1 lets agent link customers to admin accounts and reset passwords.

Reporter	Title	Published	Views	Family All 11
GithubExploit	Exploit for CVE-2026-6741	26 May 202606:10	–	githubexploit
ATTACKERKB	CVE-2026-6741	27 Apr 202619:36	–	attackerkb
Circl	CVE-2026-6741	27 Apr 202621:00	–	circl
CNNVD	WordPress plugin LatePoint 安全漏洞	27 Apr 202600:00	–	cnnvd
Cvelist	CVE-2026-6741 LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability	27 Apr 202619:36	–	cvelist
EUVD	EUVD-2026-25910	27 Apr 202619:36	–	euvd
NVD	CVE-2026-6741	27 Apr 202620:16	–	nvd
Patchstack	WordPress LatePoint plugin <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability vulnerability	27 Apr 202610:42	–	patchstack
Positive Technologies	PT-2026-35519	27 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-6741	5 Jun 202619:17	–	redhatcve

Vulners

Node

latepoint latepoint_calendar_booking_plugin_for_appointments_and_eventsRange≤5.4.1wordpress

[
  {
    "vendor": "latepoint",
    "product": "LatePoint – Calendar Booking Plugin for Appointments and Events",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.4.1",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/changeset/3514330/latepoint
wordpress	www.wordpress.org/plugins/latepoint/
plugins	www.plugins.trac.wordpress.org/browser/latepoint/tags/5.4.1/lib/helpers/roles_helper.php
plugins	www.plugins.trac.wordpress.org/browser/latepoint/tags/5.4.1/lib/models/customer_model.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/71e99412-031e-4f4a-9126-dd3a37975246
plugins	www.plugins.trac.wordpress.org/browser/latepoint/tags/5.4.1/lib/abilities/customers/connect-customer-to-wp-user.php

Parameter	Position	Path	Description	CWE
customer_id	request body	/wp-json/wp/v2/abilities/latepoint/connect-customer-to-wp-user	Privileged target binding: agent links a customer to a WordPress user without verifying target's role, enabling privilege escalation	CWE-269
wp_user_id	request body	/wp-json/wp/v2/abilities/latepoint/connect-customer-to-wp-user	Privileged target binding: agent links a customer to a WordPress user without verifying target's role, enabling privilege escalation	CWE-269
password_reset_token	path	/?latepoint_route=customer_cabinet%2Fchange_password	LatePoint password reset flow can trigger update_password leading to admin password change when token is valid	CWE-269
password	path	/?latepoint_route=customer_cabinet%2Fchange_password	LatePoint password reset flow can trigger update_password leading to admin password change when token is valid	CWE-269
password_confirmation	path	/?latepoint_route=customer_cabinet%2Fchange_password	LatePoint password reset flow can trigger update_password leading to admin password change when token is valid	CWE-269
action	query param	/wp-admin/admin-ajax.php?action=rest-nonce	Nonce retrieval for REST API access; can be used in conjunction with privilege escalation flow	CWE-269
rest-nonce	query param	/wp-admin/admin-ajax.php?action=rest-nonce	Nonce retrieval for REST API access; can be used in conjunction with privilege escalation flow	CWE-269

17 Jun 2026 11:01Current

5.2Medium risk

Vulners AI Score5.2

CVSS 3.18.8

EPSS0.00293

SSVC

CWE-269